Realms and scope

[mnot@…]

There's an implicit acknowledgement that one resource does not know about another (from p3):

A cache cannot assume that a representation with a Content-Location different from the URI used to retrieve it can be used to respond to later requests on that Content-Location URI.

However, the mechanism we use (and rely upon for performance) from p7 makes no concessions on that point. A server that operates separate fiefdoms by allocating different portions of path-space cannot prevent one vassal state from learning the secrets of any other that uses these authentication mechanisms we so love to hate.

For instance, if "/kind/and/naive" is authenticated in the realm "puppies", then "/kinda/shifty" can harvest their authentication information if a logged in user agent navigates there. See "log out" discussion for exacerbating stuff. User agents don't know (or care) for this distinction.

Of course, this is all pretty obvious, but is this worth acknowledging in Section 6?

[julian.reschke@…]

1) State it in sec cons

2) Note that new schemes should consider this

[julian.reschke@…]

Proposed patch

[mnot@…]

Please incorporate and close.

[julian.reschke@…]

From [1672]:

add security consideration wrt realms (see #348)